Skip to main content

Imagemagick CVE-2025-53101

| EUVDEUVD-2025-21389 HIGH
Buffer Underwrite ('Buffer Underflow') (CWE-124)
2025-07-14 security-advisories@github.com GHSA-qh3h-j545-h8c9
Buffer Overflow Red Hat Imagemagick Suse
7.4
CVSS 3.1 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-124
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Buffer boundary checks
Impact

CVSS 7.4. EPSS 0.1%. Public PoC/exploit available. Vendor patch available.
Exploit ScenarioDerived

An attacker could send a specially crafted request to versions to execute arbitrary code on the underlying server, potentially gaining full control of the system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

A remote code execution vulnerability in versions (CVSS 7.4). Risk factors: public PoC available. Vendor patch is available.

Earlier versions of this analysis (1)
v1 Mar 16, 2026 - 09:43 CVSS 7.4

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick mogrify command, specifying multipl

RemediationAI

Apply the vendor-supplied patch immediately.

Affected VersionsENISA

ImageMagick < 6.9.13-26
ImageMagick < 7.1.2-0

Affected Packages

nuget magick.net-q16-anycpu fix: 14.7.0
nuget magick.net-q16-arm64 fix: 14.7.0
nuget magick.net-q16-hdri-anycpu fix: 14.7.0
nuget magick.net-q16-hdri-arm64 fix: 14.7.0
nuget magick.net-q16-hdri-openmp-arm64 fix: 14.7.0
nuget magick.net-q16-hdri-openmp-x64 fix: 14.7.0
nuget magick.net-q16-hdri-x64 fix: 14.7.0
nuget magick.net-q16-hdri-x86 fix: 14.7.0
nuget magick.net-q16-openmp-arm64 fix: 14.7.0
nuget magick.net-q16-openmp-x64 fix: 14.7.0
nuget magick.net-q16-x64 fix: 14.7.0
nuget magick.net-q16-x86 fix: 14.7.0
nuget magick.net-q8-anycpu fix: 14.7.0
nuget magick.net-q8-arm64 fix: 14.7.0
nuget magick.net-q8-openmp-arm64 fix: 14.7.0
nuget magick.net-q8-openmp-x64 fix: 14.7.0
nuget magick.net-q8-x64 fix: 14.7.0
nuget magick.net-q8-x86 fix: 14.7.0
euvd imagemagick fix: 6.9.13-26, 7.1.2-0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 19 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Vulnerability type: remote code execution. CVSS 7.4 indicates high severity. Affects versions.

Know when Imagemagick gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Mar 16, 2026 - 09:43 nvd
Patch available
PoC Detected
Nov 03, 2025 - 19:16 vuln.today
Public exploit code
CVE Published
Jul 14, 2025 - 20:15 nvd
HIGH 7.4

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through vsnprintf(). Versions 7.1.2-0 and 6.9.13-26 fix the issue.

Executive ViewAI

Why It Matters

ImageMagick versions prior to 7.1.2-0 and 6.9.13-26 contain a stack overflow vulnerability that could allow attackers to execute arbitrary code on systems processing specially crafted image files. Organizations using ImageMagick for image processing workflows face potential data breach, service disruption, and system compromise if this vulnerability is not promptly addressed.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: restrict ImageMagick access to trusted input sources only, disable the mogrify command where possible, implement strict input validation to reject filenames containing consecutive %d format specifiers, and isolate ImageMagick processes in sandboxed environments with minimal privileges.

Threat Intelligence Overview

EPSS Score
0.1%
Top 79% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

57
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Imagemagick

View all
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2016-3718 MEDIUM POC
5.5 May 05

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM POC
5.5 May 05

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d

Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')

View all
CVE-2023-48230 CRITICAL POC
9.8
CVE-2023-32614 CRITICAL POC
9.8
CVE-2023-25610 CRITICAL
9.8
CVE-2021-38575 HIGH POC
8.1
CVE-2022-33896 HIGH POC
7.8
CVE-2025-61915 MEDIUM POC
6.7
CVE-2026-97008 HIGH
8.8
CVE-2022-20683 HIGH
8.6

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
imagemagick
Release Status Version
upstream released 7.1.2-0, 6.9.13-26
bionic released 8:6.9.7.4+dfsg-16ubuntu6.15+esm4
plucky ignored end of life, was needed
focal released 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2
jammy released 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm2
noble released 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
trusty released 8:6.7.7.10-6ubuntu3.13+esm13
xenial released 8:6.8.9.9-7ubuntu5.16+esm12
questing not-affected 8:7.1.1.43+dfsg1-1ubuntu1
USN-7728-1

Debian

Bug #1109339
imagemagick
Release Status Fixed Version Urgency
bullseye fixed 8:6.9.11.60+dfsg-1.3+deb11u6 -
bullseye (security) fixed 8:6.9.11.60+dfsg-1.3+deb11u10 -
bookworm fixed 8:6.9.11.60+dfsg-1.6+deb12u4 -
bookworm (security) fixed 8:6.9.11.60+dfsg-1.6+deb12u7 -
trixie fixed 8:7.1.1.43+dfsg1-1+deb13u1 -
trixie (security) fixed 8:7.1.1.43+dfsg1-1+deb13u6 -
forky fixed 8:7.1.2.15+dfsg1-2 -
sid fixed 8:7.1.2.16+dfsg1-1 -
(unstable) fixed 8:7.1.1.47+dfsg1-2 -
DLA-4297-1

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP6 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP6 Fixed

References

Advisories & patches
PATCH https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774 ADVISORY https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e ADVISORY https://github.com/dlemstra/Magick.NET/releases/tag/14.7.0 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-53101 ADVISORY https://security-tracker.debian.org/tracker/dla-4297-1 ADVISORY https://ubuntu.com/security/notices/USN-7728-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02510/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02801/ REF https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy